fix: prevent duplicate CI runs on pull request pushes

Scope the push trigger to the main branch only. Previously `on: [push,
pull_request]` fired two runs for every commit pushed to a feature
branch with an open PR — one for the push event and one for the
pull_request event. With this change, feature-branch commits trigger
only via pull_request; direct pushes to main (merge commits) trigger
via push.

Closes #483

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - main
+  pull_request:
 jobs:
   check:
     name: Full Project Check